Know your updates – Configuring Windows Update for Business Reports

Hello there! It’s been a little while since my last blog post, unfortunately, I was caring for a sick family member but on the positive side, I’m now a father so life has gotten in the way of posting, but I’m back and happy to be blogging again!

More than ever, it’s important to know your update levels for your endpoints, today, I will show you how to configure Windows Update for Business Reports, an analytical service powered by Azure Log Analytics, which will give you key information such as monitoring security, quality and feature updates for Windows 10 and 11, determine which endpoints have issues with updates and produce kusto reports as needed by your organisation, let’s get started!

Prerequisites

You will need the following for a successful setup and enrolment into Windows Update for Business Reports.

• Azure Subscription with at least contributor rights.
• Microsoft Entra ID.
• Endpoints that are Entra \ Entra Hybrid joined (Entra Registered devices are NOT supported).
• Windows 10 / 11 Professional + (WUFB Reports is not supported for Windows Server).
• Windows servicing channel of General Availability Channel.
• Following network endpoints to be allowed via enterprise firewall \ web filtering \ SSL inspection services.

Configure Windows Update for Business Reports Solution

This is a three-part process, one to create an Azure Log Analytics workspace, then configure Windows Update for Business Reports solution integration into that workspace and then finally configure Windows Update for Business Reports from within M365 Admin center, which is a new experience, previously the latter was configured directly within Microsoft Intune.

Creating the Log Analytics Workspace

Log into the Azure portal, go to Create a resource and then search for Log Analytics, then Create:

On the Log Analytics Workspace page:

• Subscription = Your Subscription for which the LAW will reside
• Resource Group = Existing RG or create new
• Name = Specify your LAW name
• Region = Your nearest region of choice

Note: Windows Update for Business Reports Log Analytic Workspaces are only supported within certain regions, see here for full list.

I will use the following for demonstration purposes:

Add tags as needed and then review and create the LAW.

Note: Although not required, it is highly recommended to implement tagging on Azure resources for easily identification and billing purposes, see here to define your tagging strategy.

Configure the Integration

Now that we have a LAW, we need to add the Windows Update for Business Reports solution to it, to do this, within the Azure Portal, search for Monitor within the marketplace, once found, go to Workbooks and Find Windows Update for Business Reports:

Within Windows Update for Business Reports section, click Get Started at the bottom, then point the service to your desired LAW, save settings and then save again, like so:

Note: See the above screenshot, it can take up to 24 hours from Microsoft to update the LAW for Windows Update for Business reports, however, I have seen this take approx 48 hours in some cases!

Configure Windows Update for Business Reports via M365 Admin Center (OPTIONAL)

This is another option to configure the Windows Update for Business Report integration via the Microsoft 365 admin center, you will still need to have configured a LAW in advance of this, if you wish to configure via the M365 admin center, then we need to go to the M365 admin center, go to Health > Software Updates and select the Windows tab:

You guessed it, select Configure Settings, and a new window will appear, it’s as simple as selecting your Azure Subscription and then the LAW that you created previously:

Enrol Devices into the service using Microsoft Intune

Now that we have configured the integration, we need to enrol devices into the service, this can be done manually, script or via Microsoft Intune, we’ll choose the latter!

First, create a settings catalog profile for Windows 10 and later:

Give it a name and description:

Add the following to the profile and deploy to your endpoints:

Note: Once everything is in place, it can take up to 24-48 hours for data to appear in the portal.

Playing with the data

Once you have some data in the LAW, you can access it via Monitor, Workbooks and then selecting Windows Update for Business Reports:

Dashboard

Overview

You’ll see the dashboard which will give you an overview of enrolled devices, Security Update and Feature Update status’:

Quality Updates

Let’s have a look at the Quality Update dashboard:

Feature Updates

Feature updates, which will also produce an alert for any devices nearing the end of life for the OS:

Driver Updates

Delivery Optimisation

If you’re not familiar, Delivery Optimisation is peer-to-peer caching of content to reduce network bandwidth, the Windows Update for Business Reports has a section to detail how much this service has been utilised, like so:

Kusto Queries

Other than looking at the dashboard, we can query the Log Analytics Workspace directly via KUSTO queries, this is particularly useful then the inbuilt dashboards do not give you the information that you desire. Here are a few examples:

All Devices with missing security updates

UCClientUpdateStatus
| where UpdateClassification == "Security" and ClientSubstate != "UpdateInstalled"
| project DeviceName, TargetKBNumber, UpdateDisplayName, ClientSubstateTime, TimeGenerated
| order by ClientSubstateTime desc

List all devices with and without a particular KB Update

let kbNumber = "KB5037771";
let installedDevices = UCClientUpdateStatus
    | where TargetKBNumber contains kbNumber and ClientState == "Installed"
    | summarize Installed = count() by DeviceName;
let notInstalledDevices = UCClientUpdateStatus
    | where TargetKBNumber contains kbNumber and ClientState != "Installed"
    | summarize NotInstalled = count() by DeviceName;
installedDevices
| join kind=fullouter (notInstalledDevices) on DeviceName
| project DeviceName, Installed = iff(isnull(Installed), 0, 1), NotInstalled = iff(isnull(NotInstalled), 0, 1)

List all devices that either have quality and \ or feature updates paused

UCClient
| where WUQualityPauseState != "NotConfigured" or WUFeaturePauseState != "NotConfigured"
| project DeviceName, WUQualityPauseState, WUFeaturePauseState, TimeGenerated

List all devices with an outdated OS Build

UCClient
| where OSQualityUpdateStatus != "Latest"
| project DeviceName, OSVersion, OSBuild, OSQualityUpdateStatus, TimeGenerated
| order by TimeGenerated desc

Resources

https://learn.microsoft.com/en-us/windows/deployment/update/wufb-reports-overview

https://learn.microsoft.com/en-us/windows/deployment/update/wufb-reports-prerequisites

https://learn.microsoft.com/en-us/windows/deployment/update/wufb-reports-configuration-intune

Until next time!